Abrigo Restores Most Sageworks Services Following Suspected Cyberattack

Abrigo has begun restoring most components of its Sageworks risk management application following an outage caused by “irregular activity” detected in its environment.

The fintech provider took the platform offline on 30 October 2026 to conduct emergency maintenance and investigate the suspicious activity. While services including the Sageworks Analyst and the Sageworks API have been brought back online, borrower-facing capabilities remain unavailable.

Impact on Financial Institutions

The Sageworks platform is used by more than 2,400 community banks and credit unions across the United States. The software is central to lending operations, helping institutions process loan applications, analyse borrower finances, and monitor loan portfolios.

Because the platform handles sensitive banking customer information, the exact nature of the incident remains unconfirmed. Abrigo has not yet disclosed whether the outage was the result of a technical malfunction or a coordinated cyberattack.

Previous Security Claims

The current incident follows previous allegations of data theft involving the company. Earlier this year, members of the ShinyHunters extortion group claimed to have exfiltrated 1.7 million Salesforce records from Abrigo, which purportedly included personally identifiable information (PII) such as names, email addresses, and phone numbers.

While a breach has not been officially confirmed in relation to those claims, cybersecurity researchers have advised banks and credit unions using Sageworks to rotate their platform API keys as a precautionary measure.